How hackers could use smart home devices to spy on you (Marketplace)

[ ♪♪♪ ] -[ Makda ] Let’s talk about
who’s watching you. High-tech break and enter. -Attention, Johanna and Peter,
your home is being attacked. -[ Makda ] What you need to
know to beat the bad guys. This is your Marketplace. [ ♪♪♪ ] -[ Makda ] we are travelling to
a small town in southern Ontario to deliver
some disturbing news. -[ Makda ] A family who lives
here is being watched by the whole world, and
they don’t know it. Here they are
renovating their front porch. And here again, sharing more
intimate moments on the back deck, captured by their
own security cameras, and broadcast over the
Internet for all to see. Anyone can keep an eye on
their comings and goings. That’s how we’ve
tracked them down, through their license plate. You can even watch
on their cameras, as we arrive to alert
them to what we’ve found. -Hi.
-Hello. -How are you?
-Good, thanks. Good, are
you the homeowner? -I am. -My name is Makda. I’m with the CBC.
-Mmm-hmm. We’re kind of here
for a strange reason. It has to do with
your security cameras. -Okay. -[ Makda ] I don’t know
if you realize this, but those cameras are actually
broadcasting on the Internet. -Really? -[ Makda ] Yeah.
So– How would you know? That’s what brought
us here, actually. We wanna show you what we found. Really? Yeah, we can show
you what’s happening right now. -Wow. Okay. -[ Makda ] You see
that right there? -And you can just get that? -[ Makda ] That’s right, yeah. This is what’s
going on right now. What do you think about that? I don’t like that at all. -[ Makda ] You had no idea
that this was possible? -No. -[ Makda ] How long have
you had those cameras up? -Six months, maybe.
–Six months. -Yeah.
-Where did you get them? Through Amazon. I ordered them, just online. They were just a
plug-and-play system, so it was easy, no wires. Everything was wireless
through your Internet. I didn’t realize that anyone
could have access to that. -[ Makda ] In truth, everyone
can have access to that. On this website, that searches
out and shows security cameras, that are using
default password settings. Toronto, Chatham, Medicine
Hat, we’ve got a house here in Mississauga. Over here we have
one in Vancouver. There are tens of
thousands of them, streaming from across
Canada and around the world. And people don’t know that
these cameras can be accessed by anybody. The website says its just trying
to expose security issues. But these homeowners are
the ones being exposed. Look at this. They’re putting
together a puzzle. I can almost see– [ Gasps ] Wow. Clothes on the chair. Wait a second. Oh, my gosh, I can see her. [ ♪♪♪ ] -[ Makda ] Over the next several
weeks we try to figure out where exactly these people live,
so we can warn them. And as we search for clues, we
find more private moments… By the pool, in the kitchen,
even upstairs near their bedrooms–moments not
meant for public viewing. And then one day… So, we’ve been looking for
clues and today we got a hit. See this right here? This is the first time that
we’ve been able to make out a license plate. By searching the license
plate and various websites, we narrow it down to an address. But is it the right one? There’s a pole here. You can see a light pole. Let’s go back to the video. You can see this here. Which seems to match the
Google Maps Street view of this address. We’re going to their house and
we’re going to tell them what we’ve been seeing and
what other people can see. We’re heading down the
highway, days later, when we think someone’s home. And once again, our arrival
is being broadcast over the Internet. Hi. -I’m Makda with the CBC.
-Yes. And the reason why
I’m here, it has to do with your
security cameras. I don’t know if
you realize this, but those security cameras
are actually broadcasting on the Internet. -Oh, I didn’t know that. -[ Makda ] The homeowner
wants his identity protected, even though his life has already
been watched around the world. We’re about to show him how. You can see here
it’s a bit of a delay, but then… I’m just going to… -Well, that’s no good. See,
that’s us right there. Mmm-hmm. -[ Makda ] And these
are your cameras. Did you ever think that
something like this was possible? -No, no. And how long
have you had these cameras? February. Okay, can I ask, why
did you think of getting them, and setting them
up around the home? I have teenage kids and I
wanna see what’s going on in my home, especially when
I am away travelling. So, you got them
for the safety of your family? Yeah. And you never
thought something like this, that anybody could just
look into your house? No. -[ Makda ] He struggles to
process the information. Steps he’s taken for security
may actually be causing harm. And what exactly
have people seen? -I mean I have a pool, I come
in and out and this and that. If my kids aren’t around I don’t
need to change or whatever, you know? It’s just–
privacy’s blown already. I don’t know how
you make that right. How are you gonna
have the conversation with your family about this? I’m not sure. Not sure. It’s quite
upsetting and disturbing. I’m not gonna lie. That’s the privacy of my
home being invaded, right? -[ Makda ] Knowing that these
cameras are playing for anyone to watch, if we figured it out
it doesn’t take much for anyone else to figure it out. Well, I’ll be disconnecting
them as soon as I go back in. -[ Makda ] So, how did the
privacy of these homeowners get so violated? We do more digging. -We have a delivery. Professional Video Security. -[ Makda ] This camera system
is the same type used by both families. It’s sold by a
company called OOSSXX. -Let’s get these positioned
so we can spy on you while you work. -[ Makda ] Oh, that
just sounds great. -So, what’s this one? This one’s the bottom right. -[ Makda ] Set up
is relatively easy. But when it comes to
connecting it to the Internet, the problem becomes clear–the
system does not require you to set a password. The default factory
setting password is empty. This means you do not
need to fill out a password. -[ Makda ] Username, admin. That means once it goes online,
other people could access your cameras too, and
there are no warnings. Okay, that’s the problem. We ask OOSSXX why it doesn’t
insist on a password like some other companies do. But they wouldn’t
answer our questions. [ ♪♪♪ ] -[ Makda ] More
smart home secrets. -What was that? -[ Makda ] And testing
some of the top brands. -I kind of like having the
different security cameras so you know what’s going on. -[ Makda ] Will this family pass
a home hack attack? Get more Marketplace. Sign up for our
weekly newsletter at cbc.com/marketplace. [ ♪♪♪ ] -[ Makda ] This is
your Marketplace. [ ♪♪♪ ] -[ Makda ] Across Canada,
homes are being transformed, by so-called smart devices
that promise to make things more convenient, and more secure. It’s automated control of
everything from our lights and locks, to our TVs
and temperature. -Alexa, set the
thermostat to 23. -Okay. -Alexa, kitchen light on. -Okay. -[ Makda ] In Canada alone,
more than 100 million of these devices are now
connected to the Internet. But there is a downside. Many people don’t know how to
secure their smart devices, allowing hackers and pranksters
to invade their homes, and their privacy. [ Screaming ] -What was that?! [ Screaming ] -[ Makda ] This woman is
terrified by the 21st century version of a crank call. -I can see you. -[ Makda ] Whoever’s controlling
her camera can also communicate with her. [ Screaming ] -[ Makda ] Even little
babies fall victim. Traumatized at night by someone,
who’s taken control of the baby monitor. The dark side of all this
new technology might not occur to most. -Yeah, that’s the indoor. -[ Makda ] Johanna Kenwood and
Peter Yarema think smart devices are both cool and convenient. -I love it. I think it just makes life so
much easier. -[ Makda ] But they’re
looking for security, too. -And that’s why I kind of
like having the different security cameras, so you know
what’s going on. -[ Makda ] So they’re careful
to pick top brands that promise security as a priority. Cameras by Nest. And a new lock by
Schlage for the front door. It’s connected to a
central hub made by Wink. All of the devices are
controlled by apps on their phones, or by their Amazon
personal assistant. Thermostat is off. Yeah, I wanna
get more of them, just spread them out a little
bit more so I can actually walk through the house and have
all the different ones going. -[ Makda ] But could
devices like these actually make us
more vulnerable? We’re about to find out.
-Park right here. -[ Makda ] This van is carrying
three white-hat hackers. Arsenii, Chris, and Michael work
for a company called Scalar. Make sure the
wireless packets– -[ Makda ] Businesses hire
them to test their security, to find weaknesses
before the bad guys do. Here we go. -[ Makda ] Johanna and Peter
have agreed to let these guys do whatever it takes
to hack their home. Okay. -[ Makda ] It isn’t long before
they figure out a key component. -Here we go.
There it is, guys. Nice. -[ Makda ] They crack the
password to the home’s Wi-Fi network. -Free Wi-Fi, everyone, now–
-[ Makda ] And then discover it’s the same password used by
Peter to control the thermostat. All right, connected! -[ Makda ] But to
get full control, they decide they need
Johanna’s password, too. Back at headquarters, they
create a phishing e-mail. It’s a fake, designed to
trick Johanna into revealing her password.
Oh, she has opened it. Message has been opened. -[ Makda ] If she clicks
on the link they sent, they’ll be able to control just
about every smart device in her house. The waiting game
doesn’t last long. Here we go. We’ve got credentials, awesome! -[ Makda ] And just like that,
they’re ready to hack the home. [ ♪♪♪ ] You can only see us
when we want you to. -[ Makda ] Don’t let
this happen to you. That’s pretty terrifying that
they’re able to get into so many devices. -[ Makda ] How to fight
back against a home hack. Do you have a story you
want us to investigate? Write to us, at
Marketplace at cbc.ca. -[ Makda ] This is
your Marketplace. [ ♪♪♪ ] -[ Makda ] We’re inside
a home in Oakville, Ontario, filled
with smart devices. What is it that you
guys like about having these smart devices?
-Convenience. Just some of the simpler
things, your hands are full, you need a light on. I like the security. I like being at work and having
the notifications going off and knowing what’s going on at my
house while I’m away from it. -[ Makda ] But outside,
three guys in a van, who have a point to
prove about that security. They’re going to try to hack it. Good to go. Let’s take a look. Let’s see what we have. -[ Makda ] Do you guys
have a favourite device? That’s a good question. I’m gonna say it’s probably
the inside camera, just so I can see the doggies
and see what’s going on. -[ Makda ] Okay,
what’s going on? Did you guys see that just now? Attention, Johanna, Peter,
your home is being hacked! Well, that’s surprising. -[ Makda ] Did you expect that? No, not the Nest camera,
’cause they usually– they’re supposed to be
the top-of-the-line, most secure out there. -[ Makda ] He just talked
to you through that. I know. -[ Makda ] And did you see
what was going on behind us? Yeah. It’s time to turn
up the heat in here. Check your thermostat! Well, our AC’s just been
put up to 32 degrees. [ Laughter ] So, it’s gonna
get hot in here. -[ Makda ] What do
you think about that? That’s pretty terrifying,
that they’re able to get into so many devices, especially–
I’d say more so the living room camera, I think. ‘Cause that’s, you
know, it’s our home, it’s the inside, we
have a child in here, and to know that
someone can get into it… -[ Makda ] Outside in the
van, they’re not done yet. Things are about to get
even more disturbing, as our hackers show some real
damage they can do when they target this personal assistant. Alexa, order a 4K TV. I’ve added a Samsung 4K
TV to your shopping list. -[ Makda ] Now what if
someone could actually do that? I wonder if they have access
to my full Amazon account, which has my credit
cards, my bankcard. Everything’s on there. -[ Makda ] And what if they do? I guess I’m gonna
be really broke soon, owe a lot of money. -[ Makda ] Did you guys– Wanna see what
we’re up to outside? Have a look at
your security camera. -[ Makda ] What’s going on? Doesn’t wanna load up. Oh, there it goes, offline. -[ Makda ] Your
camera’s off-line. Yup, so if I was at work
and someone was coming on the property,
I’d have no idea. You can only see us
when we want you to, and that time is now! -[ Makda ] So, he said you
can only see us when we want you to see us. That’s so creepy. -[ Makda ] You said it’s creepy. Why? What’s that?
-That’s our front door lock. That’s our front
door lock, yeah. I’d say that one’s the more
troubling of any of them. And unlocking. I feel unsecure now. [ Laughter ] Hi, guys. I just let myself in. My name is Arsenni and we’ve
just compromised your house. -[ Makda ] He just
unlocked your lock. He walked in here. How are you guys
feeling right now? To be honest, a
little terrified. -[ Makda ] Why? I’m gonna say especially
if I’m not around, we do have animals and
we do care about their well-being and, you know, we
don’t have the fanciest things, but, you know, you
just feel invaded. It’s your stuff. It’s your home. -[ Makda ] Arsenni says his team
could have done a lot of damage if they really wanted. Like, you saw us, we could knock off the camera,
come over and opened the door, grab a package or
whatever, and leave. -[ Makda ] What advice
do you have for them? How can they make sure
to secure their devices? Well, for one, change
your passwords. You want to have different
passwords for each one of your online accounts. Make sure you have extra secure
passwords for critical stuff like your e-mail or, say,
Nest camera, because the Nest camera is a real
window into your life, right? It really is. -[ Makda ] Strong
passwords are a must. The longer, the better–
at least 16 characters. In fact, try using
a password phrase, three or four words that
don’t mean anything together, but you’ll remember. Or use a password
manager that generates and remembers passwords for you. As for the makers
of smart devices… Did someone log in? Is it a suspicious login? Is it not your home IP address? -[ Makda ] Arsenni would
like to see some changes. What can the manufacturers do
to make things more secure? The main things that they
could implement would be use of two-factor
authentication, because, you know, having just a password
as the only thing that protects your smart home is not enough. -[ Makda ] Two-factor, or two-
step authentication is already offered by some companies,
like Apple and Google. When you log into your
account on a new device, they ask for a special code
that they send to your phone, confirmation it’s really
you and not someone who stole your password. We ask the makers of Peter
and Johanna’s devices about two-step authentication
and why it’s not required. Amazon and Nest both say
they have that option and encourage people to use it. Schlage says its locks just
took orders from the Wink hub. And as for Wink, after we
share the results of our investigation, it
announces a big change. Wink is now, “Taking
immediate steps to implement two-factor
authentication.” Meantime, our homeowners
are taking steps, too. Those unsecured cameras
were quickly unplugged, and are no longer open
for the world to see. Peter and Johanna say
they’ve learned a thing or two. How are you guys
feeling about this? You’ve got these devices because
they were cool and convenient. And they were
supposed to be secure. -[ Makda ] Do you
feel that way still? Not really. -I’d probably take the door
lock off the Wi-Fi and just keep it as a keypad. -[ Makda ] Any other
changes you would make? Definitely passwords. I think that will be the first
thing after you guys leave. Everything’s gonna get changed. [ ♪♪♪ ] -[ Charlsie ] Undercover
safety spot check. Oh, my gosh.
Oh, my gosh. That baby’s like
nine months old! Kids just don’t know
that it’s not safe. We are seeing injuries that
are occurring at speed and force that we would
not normally see. I asked her to stand up
and that’s when we realized that she couldn’t stand up. -[ Charlsie ] We visit
trampoline parks across the country, in Ontario,
Alberta, Nova Scotia, and BC. It’s an unregulated
industry no one is watching, until now.

100 Replies to “How hackers could use smart home devices to spy on you (Marketplace)”

Don't need hackers to hack your devices and spy on you!!! All companies which produce any devices with camera, microphone, trackers, sensors gathering consumer data have already spying on you, your family and love ones!!! Only the foolish one believe THE IGNORANT claims that only some foreign companies post security threats and ban them in US telecommunication network! US companies have been spying on US citizen for decades!!!

Speaking as a cyber security professional – 1) wireless is easier to hack into period because of the nature of how wifi works. Deauth the client and it will happily connect to the next loudest advertising AP, which could be a hacker waiting 2) the problem with most hardware systems is they still have a backdoor access with hard coded passwords and logins and all one needs to do is check most manufacturers websites to get the technical specs and find this info. 3) The smartest thing to do is run an intrusion detection system for your home network. 4) people needs to realize it doesn't start there…people are bad abouot putting personal info on social sites. You may think a little here and a little there is no problem, but as a hacker I will scour all your social media accounts to find as much info as possible and putting all these little bits together give me a full picture.

@10:30 – 11:15 that is just absolutely DISGUSTING!! How could ANYONE find enjoyment doing something so sick like that?! I suffer with severe panic disorder.. wake up out of a dead sleep with night terrors and panic attacks, it's horrible.

They just need a VPN. They’re more common these days anyway with technology’s advancement allowing more of us to digitize our homes and lives, and its great small step to up your security. Most VPNs are about as much as an Amazon prime subscription monthly.

This is how I assume robbery’s happen easily now as well…. this is such a violation. I think they should be sued for violating privacy laws. I have a app downloaded on my phone that I can view thousands of people across the world down from businesses to homes to daycares for dogs you name it… I wonder do they know we are watching them. It’s called web online app.

Cameras and security systems in your home being monitored by a company you're paying to keep you safe.If you are like me an trust NO ONE, any human with a heart beat cannot be trusted, you would know that just like there's bad cops, there's bad people at the security companies watching you and listening.

Don't forget Sherlock Will Smith tried to warn you back in 1998 after all you are the Enemy of the State. after all the bills did get signed. You guys do watch movies correct. They are subliminal messages.

Do you really wanna spy on someone or your proclaim lover, easy way right now is the use of hacking tools which you can really get at affordable price from _2 4 7 h a c k 3 6 5 . I n f o +1 (814) 205 3719 +1 (267) 571 3750_. Also you can get the manual to do that simply procedures are being provided in it.

I have a smart home too, even though it's not an out of the box setup. That's what happens when you let devices access the internet and don't take extra steps to secure them. Passwords aren't really enough anymore.

I finally contacted a cyber expert programmer called Andriano_cohen from United States on IG: He gave me a spy software Application, that usually keeps me informed of where my family members are and on what ever they are up too! at same time, I have access to my partners phone and full notices of my child internet activity, still i can also block any suspicious contacts if such occur…. you can also contact him on WhatsApp +1(978)706-3076 or Email— [[email protected]] for help;

I finally contacted a cyber expert programmer called Andriano_cohen from United States on IG: He gave me a spy software Application, that usually keeps me informed of where my family members are and on what ever they are up too! at same time, I have access to my partners phone and full notices of my child internet activity, still i can also block any suspicious contacts if such occur…. you can also contact him on WhatsApp +1(978)706-3076 or Email— [[email protected]] for help;

This is in no way helpful!! The whitehats got in via WiFi password hacking. The same whitehats though never mentioned that you can set your WiFi to accept only known devices. It's called MAC ADDRESS FILTERING. So have a good solid password for your router and unless that's broken… your good to go.